Merge branch 'main' into whir-split-eq

Reconcile main's arena-allocator migration (#247, "remove global_allocator
in zk-alloc") with the WHIR split-eq refactor on this branch.

Conflicts resolved:
- quotient_gkr/layers.rs: materialise_in_full keeps the branch's pub(super)
  visibility and adopts main's ArenaVec return type.
- whir/utils.rs: keep the split-eq LSB-cols FFT-prep layout but write into an
  ArenaVec via par_fill (main's allocator) instead of par_map_collect's Vec;
  drop the now-unused log2_strict_usize import.
- whir/open.rs: keep the branch's final_round / open_merkle_tree_at_challenges
  refactor and SVO sumcheck; drop main's combine_statement (deleted on this
  branch). Propagate main's ArenaVec migration through the new SVO helpers
  (SumcheckSingle.weights, lsb_fold, fold_by_tensor, build_post_svo_weights)
  to avoid Vec<->ArenaVec copies in the prover hot path.

Auto-merges verified coherent: eq_mle.rs composes the branch's
compute_eval_eq_base_batched rename/unpacked-output with main's ArenaVec
buffers; commit.rs changes are in disjoint methods.

cargo fmt / clippy clean; cargo testall (release) green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: TomWambsgans

Cargo.lock

@@ -83,8 +83,6 @@ include_dir = "0.7"
 
 [features]
 prox-gaps-conjecture = ["rec_aggregation/prox-gaps-conjecture"]
-# Build with the plain system allocator instead of zk-alloc (for comparison/debugging).
-standard-alloc = ["rec_aggregation/standard-alloc"]
 
 [dependencies]
 clap.workspace = true
@@ -102,3 +100,4 @@ system-info.workspace = true
 
 [profile.release]
 lto = "thin"
+codegen-units = 1

Cargo.toml

@@ -0,0 +1,5 @@
+# Security Policy
+
+For now, leanVM is not used in production.
+Security reports are very much appreciated: please open an issue or submit a pull request.
+A bounty program is expected to launch soon.

SECURITY.md

@@ -15,3 +15,4 @@ tracing.workspace = true
 fiat-shamir = { path = "fiat-shamir", package = "mt-fiat-shamir" }
 koala-bear = { path = "koala-bear", package = "mt-koala-bear" }
 utils = { path = "utils", package = "utils" }
+zk-alloc.workspace = true

crates/backend/Cargo.toml

@@ -92,9 +92,15 @@ fn alloc_node<F: Field>(node: SymbolicNode<F>) -> u32 {
     })
 }
 
-pub fn get_node<F: Field>(idx: u32) -> SymbolicNode<F> {
+/// # Safety
+/// `idx` must be an offset returned by `alloc_node::<F>` for the current (same `F`, uncleared) arena.
+pub unsafe fn get_node<F: Field>(idx: u32) -> SymbolicNode<F> {
     ARENA.with(|arena| {
         let bytes = arena.borrow();
+        assert!(
+            idx as usize + std::mem::size_of::<SymbolicNode<F>>() <= bytes.len(),
+            "arena index out of bounds"
+        );
         unsafe { std::ptr::read_unaligned(bytes.as_ptr().add(idx as usize) as *const SymbolicNode<F>) }
     })
 }

crates/backend/air/src/symbolic.rs

@@ -83,6 +83,8 @@ impl<Data: Clone, F: Clone> MerklePaths<Data, F> {
     }
 }
 
+const MAX_MERKLE_PATHS: usize = 1 << 10;
+
 impl<Data: Clone, F: Clone> PrunedMerklePaths<Data, F> {
     pub fn restore(
         mut self,
@@ -98,6 +100,9 @@ impl<Data: Clone, F: Clone> PrunedMerklePaths<Data, F> {
         if h >= 32 {
             return None; // prevent DoS with huge tree height
         }
+        if n > MAX_MERKLE_PATHS {
+            return None; // prevent DoS with huge number of paths
+        }
         if self.n_trailing_zeros > 1024 {
             return None; // prevent DoS with huge leaf data
         }
@@ -117,8 +122,8 @@ impl<Data: Clone, F: Clone> PrunedMerklePaths<Data, F> {
         };
         let skip = |i: usize| self.paths.get(i + 1).map(|p| lca_level(self.paths[i].0, p.0) - 1);
 
-        // Backward pass: compute subtree hashes needed to restore skipped siblings
-        let mut subtree_hashes: Vec<Vec<[F; DIGEST_LEN_FE]>> = vec![vec![]; n];
+        // Backward pass: each path donates one subtree hash (the sibling its predecessor omitted).
+        let mut donated: Vec<Option<[F; DIGEST_LEN_FE]>> = vec![None; n];
 
         for i in (0..n).rev() {
             let (leaf_idx, ref stored) = self.paths[i];
@@ -128,10 +133,12 @@ impl<Data: Clone, F: Clone> PrunedMerklePaths<Data, F> {
             let mut stored = stored.iter();
             let mut hash = hash_leaf(self.leaf_data.get(i)?);
 
-            subtree_hashes[i].push(hash.clone());
             for lvl in 0..levels(i) {
+                if lvl + 1 == levels(i) {
+                    donated[i] = Some(hash.clone()); // top level kept: this is predecessor i-1's missing sibling
+                }
                 let sibling = if skip(i) == Some(lvl) {
-                    subtree_hashes.get(i + 1)?.get(lvl)?.clone()
+                    donated[i + 1].clone()? // contributed by successor path i+1
                 } else {
                     stored.next()?.clone()
                 };
@@ -140,7 +147,6 @@ impl<Data: Clone, F: Clone> PrunedMerklePaths<Data, F> {
                 } else {
                     hash_combine(&sibling, &hash)
                 };
-                subtree_hashes[i].push(hash.clone());
             }
             if stored.next().is_some() {
                 return None;
@@ -157,7 +163,7 @@ impl<Data: Clone, F: Clone> PrunedMerklePaths<Data, F> {
             let mut siblings = Vec::with_capacity(h);
             for lvl in 0..levels(i) {
                 let sibling = if skip(i) == Some(lvl) {
-                    subtree_hashes.get(i + 1)?.get(lvl)?.clone()
+                    donated[i + 1].clone()? // contributed by successor path i+1
                 } else {
                     stored.next()?.clone()
                 };

crates/backend/fiat-shamir/src/merkle_pruning.rs

@@ -48,7 +48,7 @@ impl<F: Field, PF: PackedField<Scalar = F>> From<QuinticExtensionField<F>> for P
     #[inline]
     fn from(x: QuinticExtensionField<F>) -> Self {
         Self {
-            value: x.value.map(Into::into),
+            value: array::from_fn(|i| x.value[i].into()),
         }
     }
 }
@@ -117,10 +117,11 @@ macro_rules! impl_packed_ext_scalar_ops {
         impl Mul<KoalaBear> for PackedQuinticExtensionField<KoalaBear, $pf> {
             type Output = Self;
             #[inline]
-            fn mul(self, rhs: KoalaBear) -> Self {
-                Self {
-                    value: self.value.map(|x| x * rhs),
+            fn mul(mut self, rhs: KoalaBear) -> Self {
+                for v in &mut self.value {
+                    *v *= rhs;
                 }
+                self
             }
         }
 
@@ -281,10 +282,12 @@ where
     type Output = Self;
 
     #[inline]
-    fn neg(self) -> Self {
-        Self {
-            value: self.value.map(PF::neg),
+    fn neg(mut self) -> Self {
+        // Loop, not `self.value.map(..)`: avoids a thin-LTO de-inlined `Wrapped` closure.
+        for v in &mut self.value {
+            *v = -*v;
         }
+        self
     }
 }
 
@@ -478,7 +481,7 @@ where
 
     #[inline(always)]
     fn mul(self, rhs: QuinticExtensionField<F>) -> Self {
-        let b: [PF; 5] = rhs.value.map(|x| x.into());
+        let b: [PF; 5] = array::from_fn(|i| rhs.value[i].into());
         Self {
             value: super::extension::quintic_mul(&self.value, &b, PF::dot_product::<5>),
         }
@@ -493,10 +496,11 @@ where
     type Output = Self;
 
     #[inline]
-    fn mul(self, rhs: PF) -> Self {
-        Self {
-            value: self.value.map(|x| x * rhs),
+    fn mul(mut self, rhs: PF) -> Self {
+        for v in &mut self.value {
+            *v *= rhs;
         }
+        self
     }
 }
 

crates/backend/koala-bear/src/quintic_extension/packed_extension.rs

@@ -56,7 +56,7 @@ thread_local! {
 
 /// Calling worker's id in `0..NUM_THREADS` (`0` off-pool).
 #[must_use]
-pub fn current_worker_id() -> usize {
+pub(crate) fn current_worker_id() -> usize {
     WORKER_ID.with(Cell::get)
 }
 

crates/backend/parallel/src/lib.rs

@@ -8,7 +8,8 @@ field = { path = "../field", package = "mt-field" }
 utils = { path = "../utils", package = "utils" }
 system-info.workspace = true
 parallel.workspace = true
-tracing.workspace = true
+zk-alloc.workspace = true
+
 itertools.workspace = true
 rand.workspace = true
 serde.workspace = true

crates/backend/poly/Cargo.toml

@@ -3,6 +3,7 @@ use crate::{EFPacking, PF};
 use ::utils::{iter_array_chunks_padded, log2_ceil_usize, log2_strict_usize};
 use field::*;
 use system_info::NUM_THREADS;
+use zk_alloc::ArenaVec;
 
 const LOG_NUM_THREADS: usize = log2_ceil_usize(NUM_THREADS);
 const LOG_BATCHED_TILE_SIZE: usize = 14;
@@ -59,26 +60,29 @@ fn par_eval_eq<In, Buf, Out>(
 /// defined on the boolean hypercube by: ∀ (x_1, ..., x_n) ∈ {0, 1}^n,
 /// P(x_1, ..., x_n) = Π_{i=1}^{n} (x_i.α_i + (1 - x_i).(1 - α_i))
 /// (often denoted as P(x) = eq(x, evals))
-pub fn eval_eq<F: ExtensionField<PF<F>>>(eval: &[F]) -> Vec<F> {
+/// Returns an arena-backed table (see [`ArenaVec`]). Every eq table is phase-local proof scratch
+/// (consumed within the proving phase that built it, or system-backed when the arena is inactive,
+/// e.g. in the verifier), so it never outlives a `begin_phase()` reset.
+pub fn eval_eq<F: ExtensionField<PF<F>>>(eval: &[F]) -> ArenaVec<F> {
     eval_eq_scaled(eval, F::ONE)
 }
 
-pub fn eval_eq_scaled<F: ExtensionField<PF<F>>>(eval: &[F], scalar: F) -> Vec<F> {
+pub fn eval_eq_scaled<F: ExtensionField<PF<F>>>(eval: &[F], scalar: F) -> ArenaVec<F> {
     // Alloc memory without initializing it to zero.
-    // This is safe because we overwrite it inside `eval_eq`.
-    let mut out = unsafe { uninitialized_vec(1 << eval.len()) };
+    // This is safe because we overwrite it inside `compute_eval_eq`.
+    let mut out = unsafe { ArenaVec::uninitialized(1 << eval.len()) };
     compute_eval_eq::<PF<F>, F, false>(eval, &mut out, scalar);
     out
 }
 
-pub fn eval_eq_packed<F: ExtensionField<PF<F>>>(eval: &[F]) -> Vec<EFPacking<F>> {
+pub fn eval_eq_packed<F: ExtensionField<PF<F>>>(eval: &[F]) -> ArenaVec<EFPacking<F>> {
     eval_eq_packed_scaled(eval, F::ONE)
 }
 
-pub fn eval_eq_packed_scaled<F: ExtensionField<PF<F>>>(eval: &[F], scalar: F) -> Vec<EFPacking<F>> {
+pub fn eval_eq_packed_scaled<F: ExtensionField<PF<F>>>(eval: &[F], scalar: F) -> ArenaVec<EFPacking<F>> {
     // Alloc memory without initializing it to zero.
-    // This is safe because we overwrite it inside `eval_eq`.
-    let mut out = unsafe { uninitialized_vec(1 << (eval.len() - packing_log_width::<F>())) };
+    // This is safe because we overwrite it inside `compute_eval_eq_packed`.
+    let mut out = unsafe { ArenaVec::uninitialized(1 << (eval.len() - packing_log_width::<F>())) };
     compute_eval_eq_packed::<F, false>(eval, &mut out, scalar);
     out
 }
@@ -105,7 +109,7 @@ where
         let packed = &mut out[selector >> shift];
         let mut unpacked: Vec<EF> = unpack_extension(&[*packed]);
         compute_sparse_eval_eq::<EF>(selector & ((1 << shift) - 1), eval, &mut unpacked, scalar);
-        *packed = pack_extension(&unpacked)[0];
+        *packed = pack_extension::<_, Vec<_>>(&unpacked)[0];
         return;
     }
 
@@ -180,7 +184,7 @@ where
     let (log_chunks, n_chunks) = parallel_split();
     if eval.len() <= log_packing_width + 1 + log_chunks {
         // Small case: evaluate unpacked, then pack lanes into `out`.
-        let mut unpacked = EF::zero_vec(1 << eval.len());
+        let mut unpacked = unsafe { ArenaVec::zeroed(1 << eval.len()) };
         eval_eq_basic::<_, _, _, false>(eval, &mut unpacked, scalar);
         out.iter_mut()
             .zip(unpacked.chunks_exact(packing_width))
@@ -275,7 +279,7 @@ pub fn compute_eval_eq_base_packed<F, EF, const INITIALIZED: bool>(
     let (log_chunks, n_chunks) = parallel_split();
     if eval.len() <= log_packing_width + 1 + log_chunks {
         // Small case: evaluate unpacked, then pack lanes into `out`.
-        let mut unpacked = EF::zero_vec(1 << eval.len());
+        let mut unpacked = unsafe { ArenaVec::zeroed(1 << eval.len()) };
         eval_eq_basic::<_, _, _, false>(eval, &mut unpacked, scalar);
         out.iter_mut()
             .zip(unpacked.chunks_exact(packing_width))
@@ -340,7 +344,7 @@ where
         .map(|(eval, &scalar)| {
             let middle = &eval[n_prefix_levels..n - log_packing_width];
             let eq_suffix = packed_eq_poly::<F, F>(&eval[n - log_packing_width..], F::ONE);
-            let mut eq_prefix: Vec<EF> = unsafe { uninitialized_vec(1 << n_prefix_levels) };
+            let mut eq_prefix: ArenaVec<EF> = unsafe { ArenaVec::uninitialized(1 << n_prefix_levels) };
             eval_eq_basic::<F, F, EF, false>(&eval[..n_prefix_levels], &mut eq_prefix, scalar);
             (eq_prefix, middle, eq_suffix)
         })
@@ -875,7 +879,7 @@ pub fn compute_eval_eq_packed_dual<EF>(
 
     let (log_chunks, n_chunks) = parallel_split();
     if eval_a.len() <= log_packing_width + 1 + log_chunks {
-        let mut output_no_packing = EF::zero_vec(1 << eval_a.len());
+        let mut output_no_packing = unsafe { ArenaVec::zeroed(1 << eval_a.len()) };
         eval_eq_basic::<_, _, _, false>(eval_a, &mut output_no_packing, scalar_a);
         eval_eq_basic::<_, _, _, true>(eval_b, &mut output_no_packing, scalar_b);
         out.iter_mut()
@@ -1130,7 +1134,7 @@ fn packed_eq_poly<F: Field, EF: ExtensionField<F>>(eval: &[EF], scalar: EF) -> E
     debug_assert_eq!(F::Packing::WIDTH, 1 << eval.len());
 
     // We build up the evaluations of the equality polynomial in buffer.
-    let mut buffer = EF::zero_vec(1 << eval.len());
+    let mut buffer = unsafe { ArenaVec::zeroed(1 << eval.len()) };
     buffer[0] = scalar;
 
     fill_buffer(eval.iter().rev(), &mut buffer);